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COURSE: (TS//S I //NF) OVSC1206 Special Training on FISA (Technical) 

Module 4: ( TS//S I //NF ) Access, Sharing, Dissemination, and Retention Under the BR and PR/TT FISC Orders 
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(U) Module 4 

(TS//SI//NF) Access, Sharing, Dissemination, and Retention Under the BR and PR/TT 
FISC Orders 

(U) This module will enable you to: 

• /TS//S4-//NR Distinauish between the analysts authorized to auerv BR and PR/TT 
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metadata and those authorized to view query results 

• (TS//SI//NF) Recognize the contact chaining restrictions for RAS-approved 
identifiers 

• (TS//SI//NF) Recognize what constitutes unique BR and PR/TT query results 

• (TS//SI//NF) Identify limitations that impact the access, sharing, dissemination, and 
retention of BR and PR/TT query results 

• (TS//SI//NF) Recognize the BR and PR/TT dissemination tracking requirement and 
the additional CT nexus requirement for U.S. person identifiers 
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table 
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(TS//S I //NF ) (OGC Attorney): During this part of our trip we will identify the limitations regarding access, sharing, disseminating, and retaining of BR and 
PR/TT query results. 

(U) This module will enable you to: 

• (TS//SI//NF) Distinguish between the analysts authorized to query BR and PR/TT metadata and those authorized to view query results 

• ( TS//S I //NF ) Recognize the contact chaining restrictions for RAS-approved identifiers 

• ( TS//S I //NF ) Recognize what constitutes unique BR and PR/TT query results 

• (T S // S I / /NF) Identify limitations that impact the access, sharing, dissemination, and retention of BR and PR/TT query results 

• (T S // S I / /NF) Recognize the BR and PR/TT dissemination tracking requirement and the additional CT nexus requirement for U.S. person identifiers 

(T S // S I / /NF) If you are a technical person, you might be asking yourself if this information is directly applicable to you and your team. Compliance with the 
FISC Orders could be jeopardized by inadvertent or unintended changes in the infrastructure maintained by technical personnel. Therefore, an 
understanding of the requirements outlined in the Orders is important in the event that any technical support functions (data access, presentation, 
underlying system support - both hardware and software, etc.) cause changes to the support infrastructure that would bring NSA’s compliance with the BR 
and PR/TT Court Orders into question. 
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( TS # S J# NF ) BR and PR/TT Credentials - who can query, who can view results 
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( TS//S I //NF ) Access to BR and PR/TT raw 
metadata and query results is restricted to those 
who have the required training and appropriate 
credentials 



(TS//SI //NF ) (SV Character): Access to BR and PR/TT raw metadata and query results is restricted to those who have the required training and appropriate 
credentials. The Office of the Director of Compliance (ODOC) through the Signals Intelligence Directorate’s Office of Oversight and Compliance (SV) 
controls access to the BR and PR/TT FISA metadata, ensuring that only those who have completed all of the required training and have been granted the 
appropriate credentials are permitted to touch the metadata. 



(TS//SI //NF ) Within the analyst workforce, a distinction is made between individuals who are permittecH^iuer^h^jat^ncUhose who are permitted only 
to view the query results. Individuals who are authorized to query BR and PR/TT metadata sets have^H^^^^^^^^^^lcredentials. Division level 
management within a production center determines when query permissions will be granted to analysts based on a mission need, not solely on completion 
of BR and PR/TT FISA Training. Some technical personnel may also require query access, but their queries are for the purposes of data accuracy and 
integrity, not for target or intelligence analysis. Managers of technical personnel who require query permissions will make the determination in concert with 
their organization’s compliance office, usually either SV or TV (the Technology Directorate’s office of compliance). 
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(TS//SI//NF) How Do I Determine Who Has the Proper Credentials? 

(U) Type access ^^^Hana check credentials. 
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(TS//SI //NF ) (SV Character): So, how do you determine if an analyst or technical colleague has theappropriate credentials? a tool that can 

heljD voL^hecl^omeon^lse's credentials against your own. From your NSANet machine, type^^0|in your web browser. This takes you to the 

Lookup Utility. Insert the sid of the analyst or technicahDereor^ou^ and hit search, the formal accesses you 

share in common are displayed. From that you can determine if they hold the^l^^^^^^^^^^^^^^BDredentials. If the utility is not functioning for 
some reason, you should contact SV4 to verify the individual’s credentials before proceeding. 
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(U) Auditing and Access 

(T£//S4#NR) The Court Orders require that when the metadata is queried for intelligence 
analysis purposes that an auditable record be generated. 

(TS//SI//NF) The ^^^|audit log includes: 

• Query requests 

• User login 

• IP address 
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• Date and time of the access 
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(TS//SI//NF) What is the EAR and how does it function as a compliance safeguard? 



(TS//SI //NF) (SV Character): The BR and PR/TT Court Orders require th at an aud itable record be generated whenever metadata is queried for intelligence 
analysis purposes. When th ^ raw RR and PR/TT metadata is queried in|^^^llan automatic audit log is qenerated to enable appropriate oversight of— 
these Authorities. SV audits queries performed by both analysts and technical personnel and reviews the following on a periodic basis: 

• Query requests 

• User login 

• Internet Protocol (IP) address 

• Date and time of the access 

(TS//SI//NFWHM^^haracter): While these audits are one way to verify that only RAS-approved identifiers are used as seeds to query the BR and PR/TT 
metadata, the analytic tool used to query this metadata, employs an Emphatic Access Restriction (EAR) software to provide reasonable 

assurance that only RAS-approved identifiers are queried by analysts. While the EAR is of great benefit for analysts, it should not lessen awareness and 
attention to detail while using the NSA tools and applications associated with BR and PR/TT. We’ll discuss the EAR in greater detail later in this module. 



Comment [SLS1]: Not^oi^judio recording, this 
is pronounced as a wordJI 



Comment [SLS2]: Note for audio recording, this 
is pronounced as a word “EAR” (not as letters) 
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( TS//S I //NF ) Sourcing of BR and PR/TT Metadata Records 



] 
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(TS//S I //NF ) Within NSA’s source systems of record, BR and PR/TT metadata records are 
tagged as to their origin, which allows for: 

• Determining if information is derived from the BR or PR/TT repository 

• Software and other management controls to function properly 



(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 



( TS//S I //NF ) (OGC Attorney): Another aspect of data access and governance is the requirement for the sourcing of BR and PR/TT metadata records. As we 
mentioned in Module 2, the metadata must carry unique markings, or tags. These tags allow the analyst to determine if a particular piece of information is 
derived from either the BR or PR/TT repository. In addition, these markings enable the EAR software and other management controls to function properly. 
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1 . ( TS // S I/ / NF) Identify the individuals or groups below who are authorized to receive and view results of 
queries that contain BR and/or PR^^dat^please check all that apply). 

a) Individuals withHHHMflJHcredentials 
HMCs with HHHIHp^nd analysts with 

c) Technical personnel withlUflcredentials 

d) Your office chief and oversight personnel by virtue of their positional responsibility 

e) None of the above 

2. (TS//S I //NF ) What should you do before sharing the results of a BR_or PR/TT query with a co-worker 
working on a target reasonably believed to be associated with the^fl^ 

a) Read your e-mail to see if your co-worker asked you Tor the information 

b) Call one of the SOOs in the NSOC to find out if information about your target can be 
released to your co-worker 

c) Verify that the co-worker has the proper credentials to have access to BR and PR/TT 
information 



d) All of the above 



(U) (SV Character): Let’s check in and make a few quick notes in our travel journal and see what we remember from this topic. 



ANSWERS: 

Question 1 . (- T - S//S I /NF ) Correct! a), b), and c) describe individuals and groups holding ^^^^^^^^^redentials. 

(TS//SI/NF ) Incorrect. Positional authority does not supersede the requirement to have these specific credentials. Not all managers or SV personnel may 
require these credentials for their specific jobs. The correct answers are a), b), and c). 

Question 2. ( TS//S I /NF ) Correct! Before you share any BR or PR/TT query results with a co-worker, you must first verify that he or she has the proper 
credentials to have access to BR and PR/TT information. 

( TS // S I/NF) Incorrect, The answer is c). Before you share any BR or PR/TT query results with a co-worker, you must first verify that he or she has the 
prop er credenti a ls to have access to BR and PR/TT information. 
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( TS//S I //NF ) Analyst Queries of the BR and PR/TT Metadata 

(U) Have RAS, will query? How? 

( TS//S I //NF ) How do I recognize BR and or PR/TT results, and what are ’’unique” results? 
(U) Once I have results, how do I handle them? Are there any restrictions? 



BACK FRAME ID: 4050 



ALT TAG: 



GRAPHIC/AV: 

(U) Display and fade out the questions 
shown as an intro to the topics to be 
covered in this section. 

(U) For the transcript paragraph spoken by 
the Technical Character, consider using a 
creative treatment that shows the character 
for a brief period and then fades her out 
(perhaps a news bulletin or a postcard??). 

(TS//S I //NF) (HMC Character): In this section of the module, we’ll cover how analysts query the BR and PR/TT metadata. In addition, well go into detail on 
what constitutes BR and PR/TT results and how to tell if they are unique. Since BR and PR/TT unique results may only be shared with individuals who 
have the proper credentials, being able to identify unique BR and PR/TT query results will help you comply with the sharing and handling restrictions. 

( TS//S I //NF ) (Technical Character): While this section may appear to be more focused on analytic-specific tools, certain technical personnel also query 
these datasets to provide reasonable assurance of data integrity or to make the metadata usable for intelligence analysis. Therefore, technical personnel 
and their managers should also be aware of guidelines related to queries, handling instructions for query results, in any form, and the requirements related 
to sharing of unique query results, in any form. 
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( TS//S I //NF ) How are Analyst Queries of the BR and PR/TT Metadata Conducted? 



NEXT FRAME ID: 4075 
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(TS//SI//NF ) Queries of BR and PR/TT metadata are conducted through ^|^^|the user 
interface to^^^^^^As a default, queries are federated with data from other collection 
sources. 
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(TS//S I //NF) (HMC Character^) rice RAS approve d, an ide ntifier can be used to query the BR and/or PR/TT metadata via authorized versions of | 
the user interface to^^^^^l When launching analysts with the appropriate BR or PR/TT credentials have the option to check a box if_the^ 

wish to in clude BR or PR/TT metadata in their queries. If an analyst checks the “FISABR Mode” or “PENREGISTRY Mode” box when logging into | 
HHHwill perform a federated query. This means that in addition to either BR or PR/TT metadata, ^^^^■will also query data collected under 
additional collection authorities, depending on the analyst’s credentials. Therefore, when perform ing^auervof the BR or PR/TT metadata, analysts will 
potentially receive results from all of the above collection sources. Users of more recent versions of have the option, however, to “unfederate” 

the query, and pick and choose amongst the collection sources that they would like to query. 



[ omment [SLS3]: Note for audio recording, this 
should be pronounced as the word FISA then the 
letters B R, so simply “FISA B R” 



Comment [a4]: See Screenshot 1. 



TOP SECRET//SI//NOFORN 
Page 10 of 39 




TOP SECRET//SI//NOFORN 



TOP SECRET//SI//NQFORN 
Page 11 of 39 



TOP SECRET // SI//NOF ORN 



DATE/PREPARER: 



Topic 

( TS//S I //NF ) Querying the 
BR and PR/TT Metadata 



Home 



Page Classification 

TOP SEC R ET//CO MI NT//NOFO RN 



Screen Number 
9 of 27 



Exit 



Glossary 



Back 



i 



Next 



FRAME ID: 4075 



( TS//S I //NF ) How are Analyst Queries of the BR and PR/TT Metadata Conducted? 
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ALT TAG: 



GRAPHIC/AV: 

(U) Look at Annie’s notes and match 
transcript to screen shots. 



( TS//S I //NF ) (HMC Character): Once you are operating within the BR or PR/TT mode of remember that you may only use a RAS-approved 

identifier to query the metadata. A RAS-approved identifier that is used to initiate a query of BR or PR/TT metadata is referred to as a “seed” since it is 
being used to produce a “chain” of metadata contacts, known as contact chaining. 

(TS//SI//NF) ploys the EAR software to provide reasonable assurance that only RAS-approved identifiers are queried by analysts. Before 

executing a query on an identifier, the EAR verifies that the identifier is RAS-approved. If an analyst attempts to query a non-RAS-approved identifier while 
still in BR or PR/TT query mode, the EAR will provide reasonable assurance that no results are returned for that query; this includes data not derived from 
BR or PR/TT. This query will, howeveMD^^flected in SV’s auditing and a justification for the query attempt may be requested. If you are unsure whether 
an identifier is RAS-approved, use^^^^Mto determine the identifier’s approval status. 
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(TS//SI//NF) Contact Chaining with BR and PR/TT metadata 



(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 

(U) Look at ^^^M notes and match 
transcript to screen shots. 

( TS//S I //NF ) Create animation to explain 
the following: While the BR Order permits 
contact chaining for up to three hops, NSA 
has decided to limit contact chaining to only 
two hops away from the RAS-approved 
identifier without prior approval from your 
Division management to chain the third 
hop. Under PR/TT, the FISC limits the 
number of hops for internet 
communications to only two, and the hop 
counter will not permit these FISC- 
mandated levels to be exceeded 
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( TS//S I //NF ) (HMC Character): Once the EAR verifies that the seed that the analyst has requested to query is RAS approved, it will allow the analyst to 
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‘chain” on that identifier. In the BR and PR/TT Orders, the FISC sets limits on how extensivethisc^ We refer to this as the numbe r of hops 

from a RAS-approved identifier. For example, let’s say your target calls an associate associate then calls several^^^^|ln 

this example it is one hop from your RAS-approved identifier to the associate and anotner nop Trom tne associate to a recruit. In other words, the associate 
is a “first hop” contact of your target, and the |^^ta|are “second hop” contacts. 



(TS#SI //NF ) (OGC Attorney): Whilelthe BR Order permits contact chaininq for up to three hops, NSA has decided to limit contact chaininq to only two hops 
away from the RAS-approved identifier without prior approval from your Division management to chain the third hop. Under PR/TT, the FISC limits the 
number of hops for internet communications to only two. Technical controls will not permit these FISC-mandated hop levels to be exceeded. 

(TS//SI// NF ) (HMC Character): If another RAS-approved identifier is encountered within the authorized number of hops from the previous RAS-approved 
identifier, the number of hops resets to allow a contact chain to be generated out the authorized number of hops from the newly encountered RAS- 
approved identifier. 



Comment [a5]: We can probably use some of the 
existing screenshots we made to also illustrate the 
hops. 
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( TS//S I //NF ) What is a Query Result and how do I know if it is a BR or PR/TT Query 
Result? 

( TS//S I //NF ) Quer y Result: Queries produce results in the form of a contact chain 
presented in^^Jormat; each chain is comprised of individual contacts derived from data 
returned from the multiple collection sources queried. Each contact/line within a chain 
represents an individual Ires u It. 



Comment [a6] : This is illustrated by screenshot 2 1 



( TS//S I //NF ) (HMC Character): When you query a RAS-approved identifier in^^^^|n BR or PR/TT modes, return a ^Bfile, usually 

referred to as a chain, which is made up of the individual first hop contacts of the seed. Bearing in mind the hop restrictions just discussed, analysts may do 
further chaining on those contacts. Each of these contacts, or line within the chain, represents an individual Iresult. Remember, unless vou choose to 
unfederate your query as we described earlier, these results may have been obtained under a variety of collection authorities. 

( TS//S I //NF ) It is possible to determine the collection source or sources of each result within the chain by examining the Producer Designator Digraph 
(PDDG)/SIGINT Activity Designator (SIGAD ) and collection source( s) at the endl of the line. 



Comment [a7]: This is illustrated by screenshot 2 ] 



( TS//S I //NF ) If at least one source of a result is BR or PR/TT metadata, the classification at the be g innin g of the line will contain the phrases FISABR or 
PR/TT, respectively. In addition, in the source information at the end of the line , the SIGAD d ata can be 

recognized by SIGADs beginning wit h Fo r PR/TT, data 
collected after October 201 0 is found a 

comprehensive listing of all the BR and PR/TT SIGADs as well as information on PR/TT data collected prior to November of 2009, contact your 



Comment [SLS8]: Note for audio recording, this 
should be pronounced as a word “SIGAD” (not 
spelled out in letters as SIGAD) 



Comment [a9] : I really think we need some 
pictures to illustrate. 
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organization’s management or subject matter expert. 

(TS//SI//NF) Since it is possible that one communication event will be collected under multiple collection authorities (and multiple collection sources), not all 
of the results will be unique to one collection authority (or collection source). Keep in mind that the classification at the beginning of each result only 
indicates the highest level classification of that result, and does not necessarily reflect whethei^^^sul^va^uniau^t^on^collectioi^authontx^^i^ollectiojT^ 



I Here are examples of results originating from multiple collection sources. None of these results are considered BR- or PR/TT- 



|Comment [SLS10]: Note for audio recording, 
the acronym PDDG should be spelled out in letters 
“PDD G” followed by the word “SIGAD” - so this 
phrase will be recorded as “Producer Designator 
Digraph, or PDDG or SIGAD” 

Comment [all]: Screenshot 
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(U) (Insert image of OGC Attorney and HMC Character sitting at a table discussing the 
talking points below shown on a white board) 



BACK FRAME ID: 4080 



( TS//S I //NF ) BR- or PR/TT-“un/gue” query results are those contacts within a chain 
solely derived from the BR or PR/TT metadata and not duplicated in the results originating 
from any other authorities. 



ALT TAG: 



GRAPHIC/AV^^ 

(U) Look at^^^^notes and match 
transcript to screen shots. 



(TS//S I //NF) (HMC Character): In the examples we just discussed, none of the results were unique to any one collection authority. Frequently, however, 
you’ll find that some of the results within the chain are unique to one particular collection authority. A BR- or PR/TT-unique query result is any piece of 
information that NSA would not have had but for the BR or PR/TT metadata from which it was drawn. In other words, BR or PR/TT was the ONLY source of 
that individual contact/query result. 



( T - S//6 I //NF ) Here are some examples: example A is “E.O. 12333-unique,” while B is “PR/TT-unique,” and C is “BR-unique.’j 

( T S//SI//NF) Sharing restrictions in the FISC Orders only apply to unique BR or PR/TT query results. If query results are derived from multiple sources anc 
are not unique to BR and PR/TT alone, the rules governing the other collection authority would apply. We will discuss these sharing and handling 
restrictions in greater depth shortly. 



Comment [a 12] : Again show previous example; 



Comment [SLS13]: Note for audio recording: 
we will want some time in between saying example 
A is “E.O. 12333-unique,” and while B is 
“PR/TT-unique,” and and C is “BR-unique.” 
to allow learner to look at the examples. Please 
allow some “quiet” space that can be duplicated 
to the amount of time needed. THANKS! © 
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(TS//SI//NF) BR or PR/TT Query Results - Not Just a Line Within a Chain 
(TS//SI//NF) Examples of BR and/or PR/TT Query Results include: 

• A specific identifier 

• “Identifier A was in contact with Identifier B” 

• A .cml file (i.e. the entire contact chain/result set) that contains BR or PR/TT query 
results 

• A written or electronic depiction of a chain (i.e., the .cml file itself) or the analysis or 
partial analysis of a chain that includes BR or PR/TT results 

• A compilation or summary of first- and second-level contacts from a RAS-approved 
seed 

• A draft or a finished but not yet disseminated report 

• Any other BR or PR/TT information returned following a RAS-approved federated 
query 
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( TS//S I //NF ) (OGC Attorney): Before we discuss sharing and handling restrictions of BR- and PR/TT-unique query results, it is impor tant to understand that 
a BR or PR/TT query result is not just a line within the chain that is presented to you after you run a BR or PR/TT query in information that 

you derive, extract, or manipulate from that particular line in the chain becomes a BR or PR/TT result. Given that a source of the result is derived from BR 
or PR/TT metadata, any adaptation of that result, including information provided orally or in writing, even a tip ora lead, remains a BR or PR/TT query 
result. 

( TS//S I //NF ) (OGC Attorney): In addition, other examples of items that have been deemed to be BR and PR/TT query results include: 

• A specific identifier 

• “Identifier A was in contact with Identifier B” 

• A ^Jfile (for example the entire contact chain/resultset) that contains BR or PR/TT query results 

• A written or electronic depiction of a chain (like the ^|file itself) or the analysis or partial analysis of a chain that includes BR or PR/TT results 

• A compilation or summary of first- and second-level contacts of a RAS-approved seed 

• A draft or a finished but not yet disseminated report 

• Any other BR or PR/TT information returned following a RAS-approved federated query 



Comment [SLS14]: Note for audio recording, 
theSMEs would like for this to be pronounced “the 

- 1 know this might sound a little odd 

since we don’t say things like “the dot pdf file” but 
just trust me on this one because we had a 5 minute 
argument about it in a SME meeting. UGH! 

=n 
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(TS//SI//NF) (HMC Character): So, for example, if you run a BR or PR/TT query on a particular RAS-approved e-mail identifier and it returns information 
that depicts identifier A, the RAS-approved seed, was in direct contact with identifier B and the source of the metadata is BR or PR/TT, then just the fact 
that identifier A is communicating with identifier B is considered a BR or PR/TT query result. 

(TS//SI//NF) (HMC Character): In addition, any summary of that information would also be a BR or PR/TT query result. So, if you knew that identifier A 
belonged to Joe and identifier B belonged to Sam, and the fact of that contact was derived from BR or PR/TT metadata, if you communicate orally or in 
writing that Joe talked to Sam, even if you don’t include the actual e-mail account or telephone numbers that were used to communicate, this is still a BR or 
PR/TT query result. 

(TS//SI//NF) (OGC Attorney): Remember, if these results are determined to be BR- or PR/TT-UNIQUE, they are subject to sharing and handling 
restrictions. 
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( TS//S I //NF ) Sharing and Handling Restrictions of BR- or PR/TT-Unique Query 
Results 
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( TS//SI//NF ) Examples of handling restrictions for BR and PR/TT unique query 
results: 

Any document, .cml, or other file containing BR- or PR/TT-unique information may 
only be stored on the analyst’s personal folders, or an access-controlled, shared 
location 

y system where the results would be shared with 



Queiy results can 
individuals without 
BR- or PR/TT-unique results may not be qu 
visible to other analysts (who may not have I 
manipulated by behind the scenes analytics 



user quenes are 
or can be 



Coni me nt [a 15] : There is no «ueh list of tools 
that are ole/ nor ole to queiy, bttv. 



(TS//SI//NF) These restrictions apply to information that is SOLELY unique to BR and 
PR/TT and do NOT apply to information which is NOT unique to BR or PR/TT! 



( TS//S 1 //NF) (OGC Attorney): Remember, BR- or PR/TT-unique query results are those contacts within a chain solely derived from the BR or PR/TT 
metadata and not duplicated in the results originating trom any other authorities Any oral or written depiction, manipulation, or summary containing that 
information is also a unique query result Until they are officially disseminated, BR- or PR/TT-unique results may only be shared with individuals who hold 
the proper credentials to receive or view BR or PR/TT information. The requirement is imposed because of the special handling restrictions that we will 
discuss later in this Module. Without the proper training, the FISC-imposed handling restrictions may not be followed. 



( TS//S I //NF) (HMC Character) Unless these unique results have been disseminated, such BR- or PR/TT-uniou^nformation may only be shared with 
individuals who have the proper credentials to receive or view BR or PR/TT information. Remember, use determine a users credentials. This 

or other file containing BR- or PR/TT-unique information may only be stored on the analyst s personal folders, or an access^ 



Any document,! 



Comment [SLSlGl^ote for audio recording, 
llu;-: is pronounced 



Comment [SLS17] : Plcu 
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controlled, shared location that is accessible to only BR and PR/TT cleared personnel. 

• Query results cannot be put into any system where the results would be shared with individuals without 

• BR- or PR/TT-unique results may not be queried in tools where user queries are visible to other analysts (who may not have^^^^^^^^^^ or 
can be manipulated by behind the scenes analytics. If you have questions regarding which tools are acceptable to further researcn query results, 
please contact your management or technical director. 

( TS//S I //NF ) (SV Character) However, as we’ve discussed, not all BR or PR/TT results are unique. If a query result indicates it was derived from another 
collection source in addition to BR or PR/TT, the rules governing the other collection authority would apply to the handling and sharing of that query result. 
For example, this result came from both BR and E.O. 12333 collection; therefore, because it is not unique to BR information, it would be ok to inform non- 
BR cleared individuals of the fact of this communication, as well as task, query, and report this information according to standard E.O. 12333 guidelines. 

( TS//S I //NF ) (SV Character) In summary, if a query result has multiple collection authorities, analysts should source and/or report the non-BR or PR/TT 
version of that query result according to the rules governing the other authority. But if it is unique to either the BR or PR/TT authority then it is a unique 
query result with all of the applicable BR and PR/TT restrictions placed on it. In both cases, however, analysts should not share the actual chain containing 
BR or PR/TT results with analysts who do not have the credentials to receive or view B^t^R/TT information. In such an instance, if it is necessary to 
share the chain, analysts should re-run the query in the non-BR or non-PR/TT areas of ^^^BB and share that .cml. 
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and PR/TT query results 









( TS//S I //NF ) (OGC Attorney): The Court Orders mandate destruction of the metadata five years or 60 months after initial collection. NSA destroys the BR 
and PR/TT metadata no later than five years after collection. There are no exceptions to this requirement when it comes to the bulk metadata. 



( TS//S I //NF ) (HMC Character): The destruction requirement applies to the bulk metadata; it does not apply to query results that have been generated as a 
result of queries of RAS-approved identifiers. Once we have queried the metadata we have selected metadata, or query results, and the 60-month cutoff 
does not apply. 
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3. ( TS//S I //NF ) Please complete the following sentence. The Emphatic Access Restriction (EAR) 



a) 

b) 

c) 

d) 

e) 



createsanautomatic auditable record to allow for oversic 
alerts ^^^M wnen an individual witho 
query. 

forwards the query request to the HMC for approval. 

prohibits non-RAS-approved identifiers from being queried in || 

None of the above. 



ht of these authorities. 

lattempts to conduct a 



4. ( TS//S I //NF ) Assuming that the following answers describe uniqu e BR or PR/TT query results, which of the 
following could be shared with co-workers who do not have|g^mHmS| 

a) Having a fellow analyst review the draft of a report that contains PR/TT-derived information 

b) A summary of direct or indirec^ontact^^^A^ap proved identifiei^^^^^^^^^ 

c) Telling your manager that|H|^|^|H^frontacted 
noted in the PR/TT query you recently performed 

d) E-mailing an electronic depiction of a BR or PR/TT contact chain or a pattern 

e) None of the above. 



5. { TS//S I //NF ) TRUE or FALSE: If a query result indicates that the source of information is both Executive 
Order 12333 collection and PR/TT collection, then the analyst must handle the E.O. 12333 result according 
to the PR/TT rules. 

a) True 

b) False 

(U) (HMC Character): Let's make a few notes in our travel journal and check to see what you remember from this topic! 
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ANSWERS: 

Question 3. ( TS//S I //NF ) Correct! The EAR prohibits non-RAS-approved identifiers from being queried in 

( TS//S I //NF ) Incorrect. The correct answer is d). The EAR prohibits non-RAS-approved identifiers from being queried in^^^^^H 

Question 4. ( TS//S I //NF ) Correct! None of the examples listed should be shared with anyone outside of ^^^(l^pHchannels^^^ 

( TS//S I //NF ) Incorrect. The correct answer is e). None of the examples listed should be shared with in mu mil nli I 1 1 n n i I 

Question 5. ( TS//S I //NF ) Correct! If a PR/TT query result can also be sourced to Executive Order 12333, then the information is considered E.O. 12333 
collection and follows the E.O. 12333 processes and procedures. 

(TS//SI//NF) Incorrect. If a PR/TT query result can also be sourced to Executive Order 12333, then the information is considered E.O. 12333 collection and 
follows the E.O. 12333 processes and procedures. 
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6. (TS//SI//NF) Ifl 



H r RAS-approved identifie r, and he e-mails 

then e-mails 

| how many hops is your RAS-approved 

identifier? Are you allowed to chain that far in the PR/TT mode ofl^^^H? 



a) 

b) 

c) 

d) 

e) 



4 hops, no, unless one of the contacts between ^^^^|and RAS 

approved. 

3 hops, no (unless one of the contacts between and 
RAS approved). 

4 hops, yes. 

3 hops, no. 

2 hops, yes. 



7. ( : FS//SJ#NR) If BadguyTs identifier is RAS-approved, and he calls Associatel , who then calls 
Unknownguy, who then calls Unknownguy2, how many hops i^Dnkngwnguy2 from your RAS-approved 
identifier? Are you allowed to chain that far in the BR mode otHHH 

a) 4 hops, no, unless one of the contacts between badguyl and unknownguy2 is RAS 
approved. 

b) 3 hops, yes (with management approval). 

c) 4 hops, yes. 

d) 3 hops, no. 

e) 2 hops, yes (with management approval). 



(No audio or transcript on this page) 
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Question 6. ( TS//S I //NF ) Correct! The _ 
far unless one of the contacts between 
( TS//S I //NF ) Incorrect. The correct answer is b). I he 
permitted to chain this far unless one of the contacts' 




lis 3 hops from the RAS-app roved identifier. You would not be permitted to chain this 
|is RAS approved. 

hops from the R^^gggroved identifier. You would not be 

is RAS approved. 



Question 7. ( TS//S I //NF ) Correct! The 
approval. 

( TS//S I //NF ) Incorrect. The correct answer is b). The 
management approval. I 




|is 3 hops from the RAS-approved identifier. You are permitted to chain this far with management 
s 3 hops from the RAS-approved identifier. You are permitted to chain this far with 
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( TS//S I //NF ) Dissemination of BR-and PR/TT-Derived Information 
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(TS//S I //NF ) Dissemination of BR and PR/TT results is distributing information to external 
customers in any form to include oral or written form 
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(TS//SI//NF) Topics covered: 

• Information of foreign intelligence value which contains only foreign person information 
that IS NOT unique to BR or PR/TT 

• Information on U.S. persons (minimized) or foreign target activity unique to BR or PR/TT 
metadata 

• Information on U.S. persons (unminimized) unique to BR or PR/TT 



• Sharing of information outside 
of NSA (perhaps with FBI or 
other customer) 

(TS//SI //NF ) (OGC Attorney): Now let’s focus our attention on the dissemination of BR and PR/TT results. We define dissemination of BR and PR/TT 
results as distributing information to external customers in any form to include oral or written form. Let’s say you perform a BR or PR/TT query using a 
RAS-approved identifier, and the query returns good foreign intelligence information based on unique BR or PR/TT metadata that you would like to report 
to Intelligence Community customers. What should you do? In this topic we will discuss to what extent we can use standard processes and procedures for 
the dissemination of this information and to what extent we must use special processes and procedures for the dissemination of this special foreign 
intelligence information. Given the sensitive nature of this Program, you will not be surprised to hear that there are special rules that apply to the 
dissemination of this information. 
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fTS//SI //NF) Two additional, BR- and PR/TT-specific requirements: 

* The Counterterrorism (CT) nexus requirement applies to BR- and PR/TT-derived 
unminimized U.S. person information, but does not apply to BR- or PR/TT-derived non- 
U.S. person information or BR- or PR/TT-derived minimized U.S. person information 

• The dissemination tracking requirement applies to all BR- and PR/TT-derived 
information 



I Attorney): First of all, every disseminated report from NSA must include sourcing information so that we know where the information 
came from, as well as follow allillSSID SP001 8 minimization requirements and procedures. For BR-and PR/TT-derived information, the analyst or reports 
needs to make sure that the information included in that report is properly sourced to the appropriate BR or PR/TT authority. 



Comment [SLS 18]: UPDATE 7/13/11 from the 
SMEs: Please record at USSID 1 8 (do not say SPEW 
or SPOW, just “USSID 18” 



i In addition, the Court Orders for both the BR and PR/TT authorities have imposed two unique, stringent requirements with respect to 
disseminating information from these authorities. The first is the Counterterrorism, or CT, nexus requirement, and the second is the dissemination tracking 
requirement. 
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(a) that the U.S. person information is related to CT information, and 

(b) that the U.S. person information is necessary to understand the CT information 
or to assess its importance 



(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 

( TS//S I //NF) Image to explain the CT Nexus 



(TS//S 1 //NE) (OGC Attorney): The CT nexus requirement applies only to U S person information If you run a query and the information returned is all 
foreign person information, then the CT nexus requirement does not apply to this situation. However, if your query results include U.S. person information 
derived from BR or PR/TT and you want to disseminate that information to an external customer, such as the FBI, then this requirement must be met prior 
to dissemination, in any form. Traditionally, under |USSID SPQ01 8, if there is a piece of unminimized U.S. person information that you would like to 
disseminate, one of the designated approval authorities (to be covered on the next screen) needs to determine that the information is necessary to 
understand the foreign intelligence in that particular intelligence report before the information can be released. For BR and PR/TT, the requirement is 
slightly different. 



Comment [SLS 19]: UPDATE 7/1 341 from the 
SME*: Please record at USSTD 1 R fcb nor ?.ay SPEW 
or SPOW. jusi “US SID IS” 



(TS//S I //NE) (OGC Attorney): With respect to the BR and PR/TT authorities, the unminimized U.S. person information not only has to relate to and be 
necessary to understand the foreign intelligence information in the report, but it has to relate to and be necessary to understand the Counterterrorism 
information. 
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fPS#SI //NF) (HMC Character): Recall the RAS process and how you derived this information. The identifier you used t o uenerate this information was 
approved based upon the RAS standard. It was found to be an identifier reasonably believed to be used by someone I 



fPS#SI //NF) (HMC Character): It might seem as though the information would most certainly be counterterrorism-related since, due to the RAS approval 
process, you wouldn’t have this U.S. person information from a query of BR or PR/TT if it weren’t related to counterterrorism. In the majority of cases, it will 
be counterterrorism-related; however, the nature of the counterterrorism target is that it often overlaps with several other areas that include 
counternarcotics, counterintelligence, money laundering, document forging, people and weapons trafficking, and other topics that are not CT-centric. Thus, 
due to the fact that these authorities provide NSA access to a high volume of U.S. person information for counterterrorism purposes, the Court Order 
requires an explicit finding that the information is in fact related to counterterrorism prior to dissemination. Therefore, one of the approved decision makers 
must document the finding using the proper terminology. It must state that the information is related to counterterrorism and that it is necessary to 
understand the counterterrorism information. 

(TS//SI//NF)-(OGC Attorney): While the USSID SP0018 process is the most familiar method of governing the dissemination of unminimized U.S. person 
information obtained from traditional SIGINT means, the CT nexus requirement is an additional protection for U.S. person information being disseminated 
when the BR or PR/TT authorities, and metadata obtained by virtue of those authorities, is the source of the information. The FISC wants to ensure that the 
authorities are being used for counterterrorism purposes as intended, so consider the CT nexus requirement a step above justifying a foreign intelligence 
requirement. 
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(U) USSID SP0018 
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• (U //FOUO ) The Chief and Deputy Chief of Information Sharing Services 

• (U //FOUO ) The Senior Operations Officers (SOOs) of the National Security 
Operations Center (NSOC) 

• (U //FOUO ) The Director and Deputy Director of the Signals Intelligence Directorate 

• (U //FQUQ ) The Director and Deputy Director of NSA 



(U) This approval authority cannot be delegated to anyone else! 



(T S//S I //NF) (OGC Attorney): Certain positions are authorized to validate the CT nexus requirement, as we just discussed, and approve the dissemination 
of U.S person(s) information that we obtain from these two authorities. 



( T S // SI //N E ) (OGC Attorney): Recall from your USSID SP001 8 training, there are certain positions at NSA which have the authority to approve the 
dissemination of information that would identify a U.S. person either by name or by context Those positions are listed in USSID SP0018 and include the 
Chief and Deputy Chief of the Information Sharing Services Office, the Senior Operations Officers (|SOO |) within the National Security Operations Ce nter 
(NSOC), the Director and Deputy Director of the Signals Intelligence Directorate (SID), and in some cases they include the Director and Deputy Director o 
NSA 

( TS//S I //NF) (HMC Character): The list of positions which can approve the dissemination of unminimized U.S. person information derived from unique BR 
and PR/TT query results is the same as those named in USSID SP0018 



c< 

thi 

“rtl 


Mnment [SLS20] : Vote for audio recording, 
s i?. pronounced a?, a word “SOO" {rhymes with 
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Comment [SLS 21]: Vote for audio recording, 
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(TS#SI //NF) (OGC Attorney): It is important to note that the authority to approve the dissemination of U.S. person information cannot be delegated. This 
responsibility is assigned only to the positions named in the BR and PR/TT Court Orders. Let’s say, for example, that the Chief and Deputy Chief of 
Information Sharing Services Office, the two individuals who on a normal daily basis would be making the decision, are both on vacation on the same day. 
In this instance, someone else within their office may be the acting chief on that day; however, the acting chief cannot make the decision to disseminate 
U.S. person information. 

(TS//SI //NF ) (HMC Character): Under these circumstances, if information about a U.S. person must be disseminated on that day, then you should send 
your dissemination request to one of the other positions named in the Orders. This would logically be the NSOC SOO. 

(TS//SI //NF ) (OGC Attorney): With respect to non-U. S. person information, standard NSA practices and policies (such as proper sourcing information) 
apply. 
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fTS//SI#N-F) (OGC Attorney): The other requirement, which applies to both U.S. person information as well as foreign person information, is the 
dissemination tracking requirement regarding the dissemination of BR- and PR/TT-derived information. The Orders require NSA to track and report to the 
FISC every instance in which NSA disseminates any information derived from either of these two authorities. 



(TS#SJ#NF) (HMC Character): This refers to information disseminated in a formal report as well as information disseminated informally such as written or 
oral collaboration with the FBI. We need to count every instance in which we take a piece of information derived from either of these two authorities and 
disseminate it outside of NSA. 

(TS//SWNF) (HMC Character): Normally an NSA product report is the record of a formal dissemination. In the context of the BR and PR/TT Programs, an 
official RFI response or Analyst Collaboration Record will also be viewed as dissemination. Because this FISC requirement goes beyond the more standard 
NSA procedures, additional diligence must be given to this requirement. NSA is required to report disseminations formal or informal to the FISC every 30 
days. 
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(U) Post-Dissemination Restrictions? No, Restrictions lifted once Disseminated 
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(U) Possible cutaway images may include: 



( TS//S I //NF ) Once approved for dissemination, BR- or PR/TT-derived information can be 
used within NSA for any lawful purpose, and the sharing restrictions no longer apply 



• Image that portrays the lifting of the 
sharing restriction once information 
is approved for dissemination 

(TS//SI //NF ) (OGC Attorney): Once BR and PR/TT information has been disseminated (such as in a product report, RFI, or briefing), generally speaking, 
there are no follow-on restrictions that either NSA or our customers need to follow regarding the sharing or dissemination of that information contained in 
the report. The Orders do not impose any restrictions on the use of formally reported information from the BR or PR/TT authorities; therefore, this 
information can be used for any lawful purpose. 



(TS//SI// NF ) If BR- or PR/TT-derived information is disseminated outside of NSA, then the restriction^]^ sharing of that same information at NSA 
no longer apply. For ex^^^^^^^^^^^^^^^jsseminated can be shared outside of ^^^^^^^Hchannels, and the identifiers can be used in 
other tools such as the 
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FRAME ID: 4200 


(U) Knowledge Check 3 

8. (TSflSIffNF) Identify the additional requirements regarding the dissemination of unminimized U.S. person 
information derived from BR or PR/TT information: 

a. The Counterterrorism nexus check 

b. The Counterintelligence nexus check 

c. The dissemination tracking requirement 

d. The sourcing requirement 

e. Both a) and c) 

9. (TS//SI//NF) TRUE or FALSE: the dissemination tracking requirement applies to only U.S. person BR- or 
PR/TT-derived information. 

a. TRUE 

b. FALSE 
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(U) (OGC Attorney): Before we move on to th 


e next part of our trip, let’s make a few notes in our travel journal. 


ANSWERS: 

Question 8. (TS//SI//NF) Correct! The Court Orders for both the BR and PR/TT authorities have imposed two unique requirements with respect to 
disseminating information from these authorities. The first is the Counterterrorism, or CT, nexus check (which applies only to U.S. person information), and 
the second is the dissemination tracking requirement. 

(TS//SI//NF) Incorrect, the correct answer is e). The Court Orders for both the BR and PR/TT authorities have imposed two unique requirements with 
respect to disseminating information from these authorities. The first is the Counterterrorism, or CT, nexus check (which applies only to U.S. person 
information), and the second is the dissemination tracking requirement. 

Question 9. (TS//SI//NF) Correct! The dissemination tracking requirement applies to both U.S. person and non-U. S. person BR- and PR/TT-derived 
information. 

(TS//SI//NF) Incorrect. The dissemination tracking requirement applies to both U.S. person and non-U. S. person BR- and PR/TT-derived information. 
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10. (TG//SI//NF) For the purpose of the BR and PR/TT Programs refers to the distribution of 

information to customers in any form. is the provision of BR and PR/TT FISA query results with 


NEXT FRAME ID: 4220 


others inside of NSA authorized to receive BR and PR/TT query results. 

a) Dissemination, Distribution 

b) Sharing, Dissemination 

c) Dissemination, Sharing 


BACK FRAME ID: 4200 


d) Sharing, Distributing 


ALT TAG: 


1 1 . (TS//SI//NF) Which one of the following NSA positions does not have the authority to approve the 
dissemination of BR- or PR/TT-derived unminimized U.S. person information? 

a) The SOOs in the NSOC 

b) The Director and Deputy Director of the Signals Intelligence Directorate 

c) The Director and Deputy Director of NSA 

d) The Office of General Counsel (OGC) 

e) The Chief and Deputy Chief of Information Sharing Services 


GRAPHIC/AV: 


(No audio or transcript on this page) 




ANSWERS: 

Question 1 0. (TSASI//NF) Correct! Dissemination is the more formal distribution of information to customers in either oral or written form. Sharing is the 
provision of BR and PR/TT FISA query results with others inside of NSA authorized to receive BR and PR/TT query results. 

(TS//SI//NF) Incorrect. The correct answer is c) Dissemination is the more formal distribution of information to external customers in either oral or written 
form. Sharing is the provision of BR and PR/TT FISA query results with others inside of NSA authorized to receive BR and PR/TT query results. 


Question 1 1 . (TSASl/ZNF-) Correct! The answer is d) The OGC does not have the authority to approve the dissemination of BR- or PR/TT-derived unminized 
U.S. person information. 

ffS//SI//NF> Incorrect. The answer is d) The OGC does not have the authority to approve the dissemination of BR- or PR/TT-derived unminized U.S. 
person information. 
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(U) Now that we have completed this part of your trip you should be able to: 

• ( TS//S I //NF ) Distinguish between the analysts authorized to query BR and PR/TT 
metadata and those authorized to view query results 

• (TSZZ S IZZNF) Recognize the contact chaining restrictions for RAS-approved 
identifiers 
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(TSZZS I ZZNF ) Recognize what constitutes unique BR and PRZTT query results 

(TSZZS I ZZNF ) Identify limitations that impact access, sharing, dissemination and 
retention of BR and PRZTT query results 

(TSZZS I ZZNF ) Recognize the BR and PRZTT dissemination tracking requirement and 
the additional CT nexus requirement for U.S. person identifiers 



( TS//S I //NF ) (OGC Attorney): Remember, you are responsible for ensuring that the recipient of query results is authorized to receive these results. Also, 
you must be mindful of the special restrictions for dissemination, either oral or written, of the BR- and PR/TT-derived information. 



(U) (OGC Attorney): Now that we have completed this part of the trip you should be able to: 

• ( TS//S I //NF ) Distinguish between the analysts authorized to query BR and PR/TT metadata and those authorized to view query results 

• ( TS//S I //NF ) Recognize the contact chaining restrictions for RAS-approved identifiers 

• (TS/ / SI / /NF) Recognize what constitutes unique BR and PR/TT query results 

• ( TS//S I //NF ) Identify limitations that impact access, sharing, dissemination, and retention of BR and PR/TT query results 

• ( TS//S I //NF ) Recognize the BR and PR/TT dissemination tracking requirement and the additional CT nexus requirement for U.S. person identifiers 
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“U.S. Person #1” 
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“John Doe” 
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